A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
| Link | Tags |
|---|---|
| https://vuldb.com/?id.321853 | technical description vdb entry |
| https://vuldb.com/?ctiid.321853 | signature permissions required |
| https://vuldb.com/?submit.636625 | third party advisory |
| https://github.com/o2oa/o2oa/issues/170 | issue tracking |
| https://github.com/o2oa/o2oa/issues/170#issuecomment-3212894835 | issue tracking |
| https://github.com/o2oa/o2oa/issues/170#issue-3328947938 | issue tracking exploit |